CVE-2026-54787
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In the sigstore-go library prior to version 1.2.1, a bundle signing timestamp is not checked against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate. This allows an attacker holding expired key material to sign accepted bundles.
Risk Assessment
An attacker can sign bundles using expired keys, potentially leading to acceptance of unauthorized or malicious bundles in the software supply chain.
Recommendation
Update sigstore-go to version 1.2.1 or later.
Original NVD description (English source)
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1.